Xtream Codes API Tester: How to Probe a Portal Endpoint

An API tester sends raw requests to a Xtream Codes portal and shows you the JSON the portal returns. It’s the debugging tool for developers and power users — the way to verify authentication, enumerate categories, and check EPG data against your own portal. This guide covers the safe way to probe a portal.

The endpoints you’ll test

Every Xtream Codes portal exposes player_api.php. The core read endpoints are:

Purpose	Endpoint
Authentication + account status	player_api.php?username=U&password=P
Categories (live/VOD/series)	...&action=get_live_categories / get_vod_categories / get_series_categories
Stream lists	...&action=get_live_streams / get_vod_streams / get_series
EPG	...&action=get_short_epg&stream_id=ID
VOD info	...&action=get_vod_info&vod_id=ID

The full parameter reference is in The Xtream Codes API.

Testing with curl

Authentication check:

curl "http://portal.example:8080/player_api.php?username=USER&password=PASS"

Live categories:

curl "http://portal.example:8080/player_api.php?username=USER&password=PASS&action=get_live_categories"

Stream list for a category (add category_id):

curl "http://portal.example:8080/player_api.php?username=USER&password=PASS&action=get_live_streams&category_id=1"

Short EPG for one stream:

curl "http://portal.example:8080/player_api.php?username=USER&password=PASS&action=get_short_epg&stream_id=1001"

Testing with a REST client

A REST client like Postman or Insomnia makes exploration easier:

1. Create a request for player_api.php with your username and password as query params.
2. Start with no action to confirm authentication.
3. Add actions one at a time and save the working requests as a collection.
4. Keep credentials out of any shared/synced collection — store them as an environment variable.

Security note: your username and password are in every URL. A REST client with cloud sync can leak them to third-party services. Prefer a local tool, or a private environment. See Xtream Codes security.

Reading the responses

• user_info — confirms auth and status (see authentication).
• Categories — each entry has category_id, category_name, and parent_id. Empty results mean the account has no content in that type.
• Streams — each entry has stream_id, name, and stream_icon. The playback URL is derived: /live/USER/PASS/STREAMID.m3u8.
• EPG — epg_listings arrays with start, stop, and title. See Xtream Codes EPG.

Good practices when testing

1. Test only your own portal and credentials.
2. Keep request rates low — loops of rapid requests can trigger rate limiting.
3. Use read-only actions first — there’s no write API for normal accounts, so if a tool offers to “modify” the portal, treat it as suspicious.
4. Scrub credentials before pasting responses into forums or issue trackers.

A practical debugging sequence

When a player fails but you’re not sure why, probing the API in order isolates the fault faster than trial and error:

1. Authentication only — run player_api.php with no action. A valid user_info with auth: 1 rules out the login itself. If auth is 0 or the HTTP status is 401, the credentials, the account expiry, or the connection limit is the problem. See authentication.
2. One category list — get_live_categories. Empty output here means the account has no live content assigned, even though the login succeeded.
3. One stream list — get_live_streams. Compare the stream_id and name against what your player shows. A channel listed here but not in the player points to an app-side refresh or EPG issue, not the API.
4. EPG for a single channel — get_short_epg&stream_id=ID. Missing epg_listings means the guide data for that channel is empty at the source, which no player can fix.

Reading HTTP status codes

The portal answers with standard HTTP statuses, and they pin down the cause quickly:

• 200 with valid JSON — the endpoint is reachable and healthy; inspect the payload.
• 401 / 403 — authentication rejected. Check username, password, and whether auth is enabled.
• 404 — the endpoint or action path is wrong (for example, a typo in action=, or the portal doesn’t support that route).
• 429 — you’ve hit a rate limit or connection cap; back off.
• Timeout / connection reset — usually a network, firewall, or wrong-port problem rather than a credentials problem.

For a deeper explanation of each code, the general HTTP status overview applies. Treat these signals together with the user_info payload, and you can separate “my login is wrong,” “my account has no content,” and “my network is blocked” in a few requests.

Related reading

• The Xtream Codes API — full endpoint reference.
• Xtream Codes Authentication — what user_info means.
• Xtream Codes EPG — the guide endpoints.